14059 matches found
CVE-2014-0961
Cross-site request forgery CSRF vulnerability in IBM Tivoli Identity Manager ITIM 5.0 before 5.0.0.15 and 5.1 before 5.1.0.15 and IBM Security Identity Manager ISIM 6.0 before 6.0.0.2 allows remote authenticated users to hijack the authentication of arbitrary users for requests that insert XSS...
CVE-2014-2507
EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods...
CVE-2014-2506
EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to obtain super-user privileges for system-object creation, and bypass intended restrictions on data access and server actions, via unspecified vectors...
CVE-2014-2507
EMC Documentum Content Server before 6.7 SP1 P28, 6.7 SP2 before P14, 7.0 before P15, and 7.1 before P05 allows remote authenticated users to execute arbitrary commands via shell metacharacters in arguments to unspecified methods...
Directory traversal
Directory traversal vulnerability in the File Manager component in DevExpress ASPxFileManager Control for ASP.NET WebForms and MVC before 13.1.10 and 13.2.x before 13.2.9 allows remote authenticated users to read or write arbitrary files via a .. dot dot in the EVENTARGUMENT parameter...
MGASA-2014-0254 Updated wordpress package fixes multiple vulnerabilities
Updated wordpress package fixes security vulnerabilities: WordPress before 3.7.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php CVE-2014-0165. The wpvalidateauthcookie...
Updated wordpress package fixes multiple vulnerabilities
Updated wordpress package fixes security vulnerabilities: WordPress before 3.7.2 allows remote authenticated users to publish posts by leveraging the Contributor role, related to wp-admin/includes/post.php and wp-admin/includes/class-wp-posts-list-table.php CVE-2014-0165. The wpvalidateauthcookie...
Null pointer dereference
ZNC 1.0 allows remote authenticated users to cause a denial of service NULL pointer reference and crash via a crafted request to the 1 editnetwork, 2 editchan, 3 addchan, or 4 delchan page in modules/webadmin.cpp...
CVE-2013-2130
CVE-2013-2130 affects ZNC 1.0: remote authenticated users can trigger a denial of service by sending crafted requests to WebAdmin pages (editnetwork, editchan, addchan, delchan), causing NULL pointer dereferences and crashes. The connected sources corroborate multiple NULL pointer dereferences an...
CVE-2013-2130
ZNC 1.0 allows remote authenticated users to cause a denial of service NULL pointer reference and crash via a crafted request to the 1 editnetwork, 2 editchan, 3 addchan, or 4 delchan page in modules/webadmin.cpp...
CVE-2013-0304
ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery CSRF vulnerability, but due to...
CVE-2013-0304
ownCloud Server before 4.5.7 does not properly check ownership of calendars, which allows remote authenticated users to read arbitrary calendars via the calid parameter to /apps/calendar/export.php. NOTE: this issue has been reported as a cross-site request forgery CSRF vulnerability, but due to...
CVE-2014-3835
ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the filesexternal application, which allows remote authenticated users to add external storage via unspecified vectors...
Code injection
ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not check permissions to the filesexternal application, which allows remote authenticated users to add external storage via unspecified vectors...
Design/Logic Flaw
ownCloud Server before 5.0.16 and 6.0.x before 6.0.3 does not properly check permissions, which allows remote authenticated users to read the names of files of other users by leveraging access to multiple accounts...
Code injection
settings/personal.php in ownCloud 4.5.x before 4.5.6 allows remote authenticated users to execute arbitrary PHP code via crafted mount point settings...
Code injection
The document application in ownCloud Server before 6.0.3 uses sequential values for the fileid, which allows remote authenticated users to enumerate shared files via unspecified vectors...
CVE-2014-3837
The document application in ownCloud Server before 6.0.3 uses sequential values for the fileid, which allows remote authenticated users to enumerate shared files via unspecified vectors...